Security Guides
How do you scan a GitHub repository for vulnerabilities?
Cover four things when scanning a GitHub repo: dependencies, your own code, secrets and infrastructure files. Steps, a checklist table and results.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
How do you run a security review call with a buyer?
Prepare a one page agenda, bring the right owners, answer from evidence, log every follow-up, and close with dated commitments. A practical call structure.
Oct 18, 20263 min read
Security Guides
How do you rotate a Django SECRET_KEY without logging everyone out?
Set a new SECRET_KEY, move the old one to SECRET_KEY_FALLBACKS, deploy, then remove the old key later. What breaks, what survives, and the steps.
Oct 18, 20264 min read
Security Guides
How do you reward security champions without cash bonuses?
Reward champions with protected time, career credit, training, visibility and a say in standards. A menu of non cash rewards and what to avoid.
Oct 18, 20263 min read
Security Guides
How do you review a password hashing change in a pull request?
Check the algorithm, cost parameters, per password salt, pepper storage and bcrypt length limits against the OWASP Password Storage Cheat Sheet.
Oct 18, 20263 min read
Security Guides
How do you review code that deserializes untrusted data?
Flag native deserialization of untrusted input, prefer plain data formats, verify integrity first and allow list classes. Language red flags for reviewers.
Oct 18, 20264 min read
Security Guides
How do you review authorization changes in a pull request?
Review authorization changes by checking deny by default, a per-object check on every request, and tests that prove a second user is refused.
Oct 18, 20264 min read
Security Guides
How do you review a GitHub Actions workflow change safely?
Review workflow changes for untrusted input in run steps, broad token permissions, risky triggers and unpinned actions. A short checklist with sources.
Oct 18, 20264 min read
Security Guides
How do you retire an approved open source package safely?
Retiring an approved package takes a deprecation state, a usage report, a migration path and a hard stop date. Follow these steps to avoid outages.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.